Description

A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected element is the function vlan_load_form_uci of the file /usr/bin/routerd. The manipulation of the argument wan_num leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-21T02:16:53.317Z",
  "pubdate": "2026-09-21T02:16:53.317Z",
  "executiveSummary": "A critical buffer overflow vulnerability exists in the Netcore NBR200V2 router firmware version 1.3.241127.071246.\nThe vulnerability resides within the vlan_load_form_uci function located in the /usr/bin/routerd binary.\nThis flaw can be exploited remotely by an unauthenticated attacker via the manipulation of the wan_num argument.\nSuccessful exploitation potentially allows for remote code execution, denial of service, or unauthorized control over the affected network device.\nDue to the absence of vendor response and the public disclosure of exploit details, the risk level is high, as the device is susceptible to remote compromise without requiring pre-existing credentials.\nOrganizations using this hardware should treat the vulnerability as a significant security risk, as the attack surface is exposed over the network, permitting remote adversaries to trigger the overflow state.",
  "technicalDetails": "The vulnerability is a stack-based buffer overflow occurring within the vlan_load_form_uci function inside the /usr/bin/routerd binary. The flaw is triggered through the improper handling and validation of the wan_num argument.\nThe root cause of the vulnerability lies in the failure of the application to implement adequate boundary checks when processing the wan_num input before copying it into a fixed-length memory buffer. Because the application does not verify the length of the input string against the allocated buffer size, an attacker can supply an excessively long argument string, leading to an overflow of the stack memory.\nIn terms of attack flow, a remote attacker sends a specifically crafted request to the router that includes a malicious payload within the wan_num parameter. The router's web or management interface processes this input and passes it to the vulnerable vlan_load_form_uci function. During the data copy operation (likely involving unsafe functions like strcpy or sprintf), the input exceeds the buffer's capacity, overwriting adjacent memory space on the stack.\nBy carefully crafting the overflow payload, an attacker can overwrite critical control data, such as the function return address, the saved frame pointer, or local variables. Overwriting the return address allows the attacker to redirect the execution flow of the routerd process to attacker-controlled memory segments, potentially executing arbitrary shellcode or triggering a process crash resulting in a Denial of Service (DoS).\nGiven that the routerd process typically operates with elevated system privileges, successful exploitation allows for complete device compromise. This includes the ability to modify system configurations, intercept network traffic, or pivot into the internal network protected by the router.\nThe exploit is remotely accessible, meaning the adversary does not require local or physical access to the device. Authentication is not identified as a prerequisite, further increasing the risk of automated exploitation by remote actors. The lack of input sanitization within the vulnerable file makes the application highly susceptible to memory corruption attacks, and the public availability of exploit material significantly lowers the barrier for malicious entities to weaponize this flaw against vulnerable Netcore NBR200V2 deployments."
}